V-270200

Discussion

Session locks are temporary actions taken to prevent logical access to organizational systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences. Session locks can be implemented at the operating system level or at the application level. A proximity lock may be used to initiate the session lock (e.g., via a Bluetooth-enabled session or dongle). User-initiated session locking is behavior or policy-based and, as such, requires users to take physical action to initiate the session lock. Session locks are not an acceptable substitute for logging out of systems, such as when organizations require users to log out at the end of workdays. Satisfies: SRG-APP-000295

Check Content

To verify the inactivity timeout is configured for 15 minutes or less, follow the steps outlined below:

1. Sign in to entra.microsoft.us.
2. Navigate to the Gear icon (right) and select Settings >> Signing out + notifications.
3. Check that the "Enable directory level idle timeout" is selected.
4. Verify the Signing out value is 15 minutes or less.

If the directory level idle timeout is not set to 15 minutes or less, this is a finding.